This title is easy to misinterpret. If I understand correctly: Codex now encrypts sub-agent prompts and hides those prompts from the user.
edit: originally was "Codex starts encrypting prompts, uses cyphertext for inference instead"
edit: originally was "Codex starts encrypting prompts, uses cyphertext for inference instead"
It seems possible they trained this by doing full RL rollouts of agents interacting with each other. They likely view these prompts somewhat the same as raw reasoning traces, they don't want people to train directly on them.
I am unsure if this has been confirmed, but there are some signs that the opaque "compaction blob" they return from their dedicated compaction endpoint might not be text at all, rather a latent space representation of the conversation. The fact that OpenAIs compaction seems to be much higher fidelity than a lot of other providers makes me inclined to believe this.
If this is true, it doesn't seem far fetched to infer that they might be applying similar techniques to prompting subagents.
I would be curious to see if this way of spawning subagents (encrypted blob) is used when subagents of a different model type is spawned.
I Imagine next that programming languages, interfaces and API design starts going this direction next. Being written, expressed and optimized as blobs of high dimensional vector space. As humans we might still be able to understand some abstractions of what our AI's are talking about to each other, but maybe not more so then we understand how different regions of our own brain communicate with each other.
I actually built such a language: https://magarshak.com/U.html
zero-graph v1
origin source-text
module "hello"
hash "graph:a7f7e6899a73f3b4"
node #decl_ad8d9028 Function name:"main" type:"Void" public:true fallible:true
node #param_4610ae76 Param name:"world" type:"World"
node #expr_c403020c MethodCall name:"write" type:"Void"
node #expr_653eeb6e Literal type:"String" value:"hello from zero\n"
edge #expr_c403020c arg #expr_653eeb6e order:0
Even for like token efficiency it could make sense - like imagine if the representation were more compact
Agents acn already translate languages quite well. It doesn't seem crazy that they could work and think in a model specific language, and then translate back to English or something for the user
If you keep RL'ing the dispatch then the prompts are likely to keep diverging from the type of prompt a person would write (like CoT becoming increasingly incomprehensible), and that divergence is part of their competitive advantage.
> rather a latent space representation of the conversation
Student/teacher models derived from the same checkpoint convey a lot of latent information through token choice, as in: https://techxplore.com/news/2026-04-ai-chatbot-student-owls....
I wonder if this is something they can take advantage of by training on compaction inside of the RLVR loop?
this tracks. anthropic protects these as well iirc.
> I am unsure if this has been confirmed, but there are some signs that the opaque "compaction blob" they return from their dedicated compaction endpoint might not be text at all, rather a latent space representation of the conversation.
probably not a latent (to my knowledge latents aren't really part of the outer loop in ar-transformer inference processes), but maybe non-human-readable reasoning traces as occurs in fable.
and how would you load that back into the model? they are token-in, token-out, plus the KV-cache which is derived from token-in
When operating on text, you embed each token into the LLMs embedding space. You go from a discrete token to a point in embedding space.
Likewise, when processing images, you have a image embedding model which produces a set of embedding vectors representing the contents of the image in the LLMs embedding (latent) space.
This same concept can be extended to compaction. Instead if limiting yourself to discrete tokens, you could generate a set of embedding vectors which represent the contents of the compacted conversation in latent space.
These have the possibility of containing a lot more semantic information per vector, which is why this can be appealing.
A big downside is decreased interpretability. AI safety people are generally fairly opposed to latent space reasoning for example, it can be harder to tell what the model is actually doing and if it is trying to deceive you.
Hopefully they can add that.
Add? Just make the sub-agents input prompt not encrypted, change "encrypted: true" to "encrypted: false" everywhere and everything continues to work as it used to (simplified, but you get the idea).
They need to fix the regression, not add something new here.
I've gone in to look at Claude subagent/workflows and sometimes been like "no this was a mistake to spin up" ... Codex users just get to token yolo the encrypted telephone operator instructions+shell from orchestrator to subagents?
It makes more sense when you realize they don't want developers to be doing any coding at all. That's what they seem to be moving towards. From product manager to product via AI.
Because letting you look at the code would be too dangerous, you could reverse engineer an exploit to another product! Or distill their internet-distilled model!
But don't worry, at least it will be very convenient.
I was about to do the same with Sol + Ultra, but then discovered this encryption issue that prevents me from doing the same for sub-agents.
Personally I do, these tools aren't mature enough to be used without supervision
No. Agents run in VMs. Assume anywhere you’re running an agent will be compromised, because eventually, it will be.
The only reason most people haven’t is luck, they didn’t happen to install Axios or Tanstack at a certain time.
We had this discussion a few months ago where we talked about allowing people to choose an AI provider and provide their API key, thinking about enterprises with "preferred" (read: mandated) AI suppliers. We also wanted to offer the kind of very simple pricing that this is one way of enabling. But we realised pretty quickly that this would/could lead to leaking our back end prompts to customers and, although those prompts are only a part of the value add, if you could build a detailed trace of them then you'd be able to relatively easily reverse engineer a lot of what we're doing.
So we quickly dropped that idea.
it reminds me of the pre-vulkan game programming days.. drivers were black boxes, game developpers had to resort to magic tricks to do stuff, until everybody got fed up and wanted some logical ground to operate
One does find oneself slightly askance at one's own thinking sometimes, that's for sure.
But I suppose, is it really so different? I mean, back in the day moreso than now, a lot of the valuable IP in any system was in the design and specification of that system - the problems usually solved within the design and specificaion (use X algorithm, etc.) - and the code was "just" the implementation of those solutions.
So perhaps it's more of a regression in some ways: the value is in the specification (the prompt) once again.
Your point about stochastic behaviour is well made though, and there is no way to 100% guarantee or formally verify the behaviour of a system that relies on an underlying technology whose behaviour is fundamentally stochastic.
In an ideal world this would have been public tech like ARPANET or WWW and there would have been 2-3 major iterations (until the equivalent of Claude 7-8) and only then would everyone have tried to build huge businesses on top of it.
I mean, sure, it's sort of usable, but the churn is insane. And we're burning the planet (and probably the economy, too) for it.
When was the last time you used an LLM to evaluate how true those last part(s) still are?
I also love how you went from "I'm unable to understand" to "This is surely right", it's a good representation of the software ecosystem at large :)
a lot of expertise of certain domains' workflows is needed to make it functional within that domain. some of this can be yielded via prompting too etc so its also baoance of how much to prompt it vs. how much of it you wanna let it reason over itself. (if you tell it too much i lock it into a path and if you tell too little it will give incomplete results )
It sort of feels like an area of friction even still.
Billing goes to the customer, debug logs etc go to the service provider.
I already switched to a Chinese provider personally, I don't think the difference between both really justifies the wide gap in pricing
I'd be ecstatic if this was true, but nothing so far comes close to the SOTA models from OpenAI + highest reasoning, but I'd be more than happy to be proven wrong by testing it out myself.
So far, I've tried MiniMax M3, GLM 5.2, Hy3, MiMo-V2.5 (+ Pro), DeepSeek V4 Pro (+ Flash), Gemini 3, Kimi K2.6, GLM 5, all the various Qwen variants and probably a bunch more I forget about, in a wide array of harnesses (Codex, pi, opencode, my own and more), and still nothing seemingly comes close to GPT 5.5 (now 5.6) xhigh for tasks beyond 5-10 minutes of work, they all more or less collapse after a while in my experiments. Although most of those do work well for really tightly scoped tasks.
What specific model are you thinking about here, in case I've missed testing it?
Sure, Claude might be 90% correct and Kimi only 70% correct but does that matter when 90% isn't enough to make it work autonomously anyways?
My workflow is just strict supervision of what's happening, I also edit the agents file with anything I see the model doing that I don't like.
My sessions are also short, after any task which is completed, I just kill the session and start a new one so I don't think I have more than 15 min sessions unless it's tech discovery.
Huuh, what does this mean? GPT models frequently do 100% of what I tell them to do, anything less and I'd see no point in using agents for work at all. Do you tell them stuff then 30% of the cases Kimi goes off and does other things, or what do you mean? The time the agent does something unexpected, I can almost always trace it back to me fucking up something in the user prompt, or the system prompt being wrong somehow, I'd lose my mind if it was only "70% accurate".
> My workflow is just strict supervision of what's happening, I also edit the agents file with anything I see the model doing that I don't like.
Same, including inspecting exactly what the (full verbatim) sent system/user prompts are, which the change we're all discussing here is getting in the way of.
But "Kimi only 70% correct" sounds like it's so bad it's not worth using. In my testing, I didn't find that the model just went out and did other things, but all the providers I tried were way slower than even Sol which is kind of slow to begin with, and it's really inefficient with it's thinking. Tasks that took Sol five minutes could take 15 minutes with Kimi for example, which just feels like such a waste too.
I never managed to have this experience even with SOTA models, they routinely make architectural mistakes, wrong assumptions and take shortcuts they should not take. Less for sure but they still do it often. I didn't try Fable yet though so can't comment on it.
So based on that, since I have to watch everything they do anyways, why would I pay extra?
> But "Kimi only 70% correct" sounds like it's so bad it's not worth using
If you want an analogy, it's like the numbers of 9s in server availability and since currently I'd rate nothing above 90%, it's zero nines. Since I have to deal with unreliability with every provider, I don't see why it would be worth it to pay more to still deal with it.
Ah, you let them make architectural decisions? :P That might explain it. Agents for me are more like pair-programming or just "what types the code", all the design and decisions are made by me, so if those are wrong, it's my fault. The agents are just used to implement what I've decided to have implemented, and I can't remember the last time codex did a mistake without correcting itself, or made a wrong assumption or taken shortcuts, unless I explicitly told it something that lead to those things.
> So based on that, since I have to watch everything they do anyways, why would I pay extra?
Personally I pay more to have to fix less later, and for a piece of mind that if I ask it to do X, it doesn't go off and do Y.
Umm, no:
> GPT-1, GPT-2, GPT-3, GPT-3.5, GPT-4, GPT-4 Turbo, GPT-4o, GPT-4o mini, o1-preview, o1-mini, o1, o3-mini, o4-mini, o3, o3-pro, GPT-4.1, GPT-4.1 mini, GPT-4.1 nano, GPT-5, GPT-5.1, GPT-5.2, GPT-5.4, GPT-5.4 mini, GPT-5.4 nano, GPT-5.5, GPT-5.5 Pro, GPT-5.6 Luna, GPT-5.6 Terra, GPT-5.6 Sol
Besides the constant shifting of nouns and adjectives...
Luna is the Moon and Terra is Earth.
The rest just aren't names, they're designations at best